What to do when a worm uses your contacts to spread via email

An email worm can turn a compromised mailbox into a distribution system. It may send malicious attachments, shortened links, or convincing messages to people stored in your address book while making the emails appear to come from you. Some worms also use stolen passwords to access webmail, cloud storage, and other connected services.

The visible symptoms may include bounced messages, replies from unfamiliar recipients, sudden password alerts, or contacts warning that your email sent them something suspicious. Treat these signs as a security incident, even if your computer seems to work normally.

Fast action limits the number of infected recipients and helps protect your account from further misuse. The safest response combines account containment, device inspection, contact notification, and follow-up monitoring.

Disconnect the affected device

If the worm appears to be active on a Windows PC or Mac, disconnect the device from Wi-Fi or unplug its Ethernet cable. This can interrupt outgoing messages and prevent the malware from downloading additional components. Avoid opening recent attachments or clicking links in suspicious emails while investigating.

Do not immediately wipe the computer if you may need evidence for an employer, school, or security professional. Record unusual messages, sender addresses, timestamps, pop-ups, and recent software installations. If the device contains business data, contact your IT department before making major changes.

Use a separate, trusted device for urgent account actions whenever possible. A phone or computer that has current security updates and does not share the same suspicious browser session is a better choice for changing passwords and reviewing login activity.

Secure the email account

Change the email password from a clean device, and make it unique to that account. If you reused the same password elsewhere, replace those passwords too, starting with financial, work, social media, and cloud storage accounts. A password manager can generate long, unique credentials.

Review active sessions, recent sign-ins, connected applications, recovery addresses, and app-specific passwords. Sign out of devices you do not recognize and revoke access for unfamiliar applications. Check for automatic forwarding rules, filters that hide security alerts, newly created signatures, and changes to the account recovery settings.

Enable multi-factor authentication using an authenticator app or hardware security key where available. SMS verification is better than no second factor, but stronger options reduce the risk of takeover through phone-number attacks. For guidance about a suspicious campaign or malicious email infection, consult these email virus removal steps alongside your provider’s official account-recovery instructions.

Inspect and clean the computer

Run a full scan with reputable, updated security software rather than relying only on a quick scan. Windows users can use Microsoft Defender or another trusted anti-malware product; Mac users should also scan for unwanted extensions, launch agents, and recently installed applications. Remove detections only after reviewing what the security tool identifies.

If the scan cannot complete, start Windows in Safe Mode and run the security check again. On a Mac, investigate unfamiliar login items, browser extensions, configuration profiles, and applications that appeared shortly before the email activity. A worm may arrive with a trojan, spyware component, browser hijacker, or credential-stealing extension.

Update the operating system, browser, email client, and document viewers after containment. Unpatched software can allow reinfection even after the original malicious file has been removed. If suspicious behavior continues, seek specialized malware-removal guidance and preserve important files before resetting the system.

Understand the signs and response

The following symptoms can help distinguish account abuse from ordinary spam or a forged sender address. A spoofed message may use your address without accessing your mailbox, while a genuine compromise often leaves activity in sent items, login history, forwarding rules, or connected applications.

Sign	Likely meaning	Immediate response
Contacts receive messages you cannot find in Sent	Spoofing or automatic malware delivery	Secure the account and inspect the device
New forwarding rules or filters appear	An attacker may be hiding activity	Delete unauthorized rules and revoke sessions
Repeated failed login alerts	Password attacks or credential reuse	Change the password and enable MFA
Attachments launch programs or request macros	Possible malware delivery	Do not open them; scan the device
Security alerts stop arriving	Filters or recovery settings may be altered	Check rules, recovery options, and account logs

Keep copies of suspicious messages in their original format if possible. Email headers can reveal the sending infrastructure and help an administrator determine whether the mailbox was accessed. Do not forward a dangerous attachment to contacts as a warning; send a plain-text notice or use your provider’s reporting tools.

Warn contacts without spreading fear

Tell recipients that messages sent from your account may be unsafe and instruct them to delete them without opening links or attachments. Mention the approximate time range and recognizable subject lines so they can find the messages quickly. If a recipient already opened a file or entered credentials, advise them to disconnect the affected device and contact their IT or security support.

Notify people through a separate communication channel, such as a phone call, text message, or verified social profile. Avoid replying to the suspicious email chain because replies may continue the worm’s distribution or expose additional addresses. If the mailbox is used for work, let the organization’s security team handle broader notifications.

After the immediate cleanup, monitor sent mail, login alerts, bounced messages, and contact reports for several days. Continued activity may indicate a second compromised device, a stolen session token, or an account setting that was missed during the first review.

Reduce the chance of another outbreak

Email worms often depend on rushed decisions, excessive permissions, outdated software, or reused credentials. Prevention therefore involves both technical controls and safer handling of unexpected messages.

• Keep operating systems, browsers, mail apps, and security tools updated automatically.
• Disable document macros unless a trusted business process requires them.
• Use multi-factor authentication and unique passwords for every important account.
• Treat unexpected invoices, delivery notices, and shared documents as untrusted until verified.
• Maintain offline or versioned backups so malware cannot easily encrypt or alter every copy.

Limit the damage by using a standard user account for routine work and storing sensitive information in protected services. Email providers may also offer attachment scanning, link protection, and alerts for unusual sign-ins; enable these features and review their reports instead of dismissing them automatically.

If the infection involved financial information, identity documents, or workplace credentials, report it promptly to the relevant institution. A malware incident can expose more than an address book, and early notification may allow providers to freeze access or investigate fraudulent activity.

For broader security updates and step-by-step guidance covering Windows and Mac threats, use the malware removal guides available from Pc Malware Expert. Once the account is secured, the device is clean, and contacts have been warned, keep monitoring for renewed login alerts or unexpected outgoing mail so any second wave is stopped quickly.